Fallos del tipo CWE-78

5061 resultados

Injeção de Comando do Sistema Operacional

A aplicação constrói comandos do SO (shell, cmd.exe, etc.) usando dados de entrada do usuário ou de fontes externas sem validar ou sanitizar adequadamente. Um atacante consegue injetar metacaracteres especiais (como ;, |, &, `, $()) para executar comandos arbitrários além daqueles originalmente planejados.

Ejemplo

Uma API que executa `ping hostname` recebendo o hostname como parâmetro GET faz isso: `exec('ping ' + request.query.host)`. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.

Cómo mitigar

Evite construir comandos concatenando strings com entrada externa — use bibliotecas que parametrizem comandos ou listas de argumentos (como execFile no Node.js, subprocess com lista em Python, ProcessBuilder em Java). Se for inevitável, valide contra uma whitelist rígida e, se disponível, use modo restrito do shell (sh -c com argumentos seguros) ou contenha a execução em sandbox/container.

CVE-2021-3198MEDIUMIvanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionEPSS 3.3%CVE-2020-13378HIGHLoadbalancer.org Enterprise VA MAX through 8.3.8 has an OS Command Injection vulnerability that allows a remote authenticated attacker to exEPSS 3.3%CVE-2026-25070CRITICALXikeStor SKS8310-8X PingTestSet Command InjectionEPSS 3.3%CVE-2019-15979HIGHCisco Data Center Network Manager Command Injection VulnerabilitiesEPSS 3.3%CVE-2026-60121CRITICALVitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.phpEPSS 3.3%CVE-2024-23109CRITICALAn improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to EPSS 3.3%CVE-2021-24033—react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be EPSS 3.3%CVE-2026-8986CRITICALCommand Injection via Malicious OCPP ServerEPSS 3.3%CVE-2025-66213CRITICALCoolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount PathEPSS 3.3%CVE-2022-31138HIGHOS Command Injection in mailcowEPSS 3.3%CVE-2025-10774MEDIUMRuijie 6000-E10 sub_commit.php os command injectionEPSS 3.3%CVE-2026-82692CRITICALD-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injectionEPSS 3.3%CVE-2026-82689CRITICALD-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injectionEPSS 3.3%CVE-2026-90699CRITICALD-Link DWR-M920 formPinManageSetup sub_41E60C os command injectionEPSS 3.3%CVE-2026-85223CRITICALD-Link DNS-340L CGI dropbox.cgi os command injectionEPSS 3.3%CVE-2026-71966HIGHCyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransferEPSS 3.3%CVE-2022-37899HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%CVE-2022-37901HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%CVE-2025-56094HIGHOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POSTEPSS 3.3%CVE-2022-37900HIGHAuthenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitieEPSS 3.3%